Virginia Employers Beware: New Limits on Social Media Access

The new law will prohibit an employer from requiring an applicant or an employee: (1) to disclose his/her user name and password to that individual’s social media account; or (2) to add an employer (supervisor or IT administrator) to the list of contacts associated with a social media account. Further, employers are prohibited (a) from taking action against or threatening an employee for “exercising his rights under this section” or (b) from refusing to hire someone for “exercising his rights under this section.”

The statute contains a very broad definition of “social media accounts” but also contains important exclusions. “Social media accounts” are defined to mean a “personal account” where users can create, share and view content including photographs, blogs, messages and emails, as well as website profiles or locations. This definition includes not just LinkedIn, Facebook and Twitter, but personal email accounts maintained with web-based email service providers like Gmail, Hotmail and Yahoo, as well as blogs. Excluded is any account: (1) opened by an employee at the request of the employer; (2) provided to an employee by an employer, e.g. a work email account or other program owned and operated exclusively by the employer; (3) set up by an employer on behalf of the employee; or (4) set up by an employee to impersonate an employer through the use of the employer’s name, logo or trademark.

The statute makes clear that employers are not prohibited from viewing information that is publicly available, nor does it affect the employer’s ability to request an employee to disclose his/her user name and password for the purpose of accessing a social media account if the employee’s activity is reasonably believed to be relevant to a formal investigation (or a related proceeding) by the employer into allegations of an employee’s violation of law or the employer’s written policies. If the employer obtains the employee’s user name and password for investigative purposes, it must only be used for that purpose and nothing else.

The statute also provides that an employer who “inadvertently receives” an employee’s user name and password (or other login information) associated with an employee’s social media account through the use of an electronic device provided to the employee, or through a program that monitors the employer’s network, shall not constitute a violation of this new prohibition so long as the information is not used to gain access to the social media account.

There are five initial takeaways from this new law:

(1)        Employers can continue to “surf and search” the Internet, including social media sites, where information is publicly available, even if it is found on the social media account of an applicant or employee.

(2)        Companies will still have the ability when conducting an investigation to require an employee to provide login information to their personal Gmail account and/or other personal social media accounts when the information is “reasonably believed” to be relevant to a formal investigation (or a related proceeding) by the employer into allegations that federal, state or local law or the employer’s written policies have been violated. Fishing expeditions should be avoided.

(3)        Social media accounts now include personal email accounts of your employees. When employees access their personal gmail, hotmail or yahoo accounts on your company-provided laptop, those emails will still reside on the hard drive. How this statute will apply when an undisclosed forensic examination of hard drives is occurring will be interesting to watch.

(4)        The new statute does not address what an employer can do in response to a co-worker who provides to the employer information posted on a private “social media account,” nor does it expressly limit an employer’s right to discipline an employee for content posted on a private social media account once the information is brought to the employer’s attention. What seems clear is that an employer who attempts to do indirectly what it cannot do directly, i.e., getting a co-worker to access a personal social media account in order to give the information to a supervisor, will be inviting a legal action.

(5)        Last, the statute does not provide a specific remedy for violations unlike other provisions of Title 40.1, so one must assume that an intentional tort claim for compensatory and punitive damages will be available.

As all of us come to live more of our lives in the digital world, there is sure to be increasing interest in defining a zone of privacy, and will invite litigation and ever increasing legislation. Virginia will be one of 19 states with legislation in this area and there is no uniformity in these laws. Employers must keep abreast of the rules in the jurisdictions where they operate. For further advice on these issues, please feel free to contact David Paxton at 540.983.9334, or any of the lawyers in Gentry Locke’s Employment Law group.